PHP2Shell: critical PHP flaws force governments to take websites offline; patch now

Two critical security flaws in PHP, the programming language that runs most of the world's websites, are forcing governments and companies to rush out updates or take sites offline. The PHP project released fixes on Wednesday, October 21, 2026 for the bugs, nicknamed PHP2Shell, which let attackers take control of a web server without logging in, and security firms say criminals began trying to exploit them within hours.

What happened

The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow "unauthenticated remote code execution". In plain terms, an attacker on the internet can send a crafted request to a site and make the server run their own code — enough to steal data, plant malware or use the machine to attack others. The US Cybersecurity and Infrastructure Security Agency (CISA) said the bugs affect all PHP installations that serve web requests. Severity scores of 9.2 and 9.8 out of 10 have been cited.

Item	Detail
Nickname	PHP2Shell
CVE numbers	CVE-2026-109618, CVE-2026-109619
Disclosed and patched	Wednesday, October 21, 2026
Impact	Remote code execution without login
Fixed versions	PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35
Unsupported versions	PHP 8.1 and older — no official fix
Official advice	Patch now; if not possible, take systems offline

The PHP team said updating is the only complete fix; changing settings such as memory and upload limits only reduces exposure.

Sites taken offline

Several governments switched services off as a precaution while they patched:

• Australia: the Australian Signals Directorate said cyber.gov.au and other government websites had outages, and the Home Affairs minister's office said several sites were temporarily unavailable.
• France: the Interior Ministry took local government administrative websites offline.
• Finland: state IT provider Valtori shut public network services.
• Denmark: public IT body Kombit closed several services, including the national school communication platform.
• Netherlands: the national cybersecurity agency took its own website down.

Wikipedia said it was applying the fix across its sites.

How the flaws were found

OpenAI said its AI models helped researchers identify ways to exploit the flaws and that it led a group of maintainers and security firms preparing fixes before disclosure. The PHP Foundation said a possible attack had been theorised as early as 2024 but work on a fix stalled. It said disclosure was brought forward after details began circulating on online forums and social media, and admitted the delay had been "a structural failure".

Are hackers already exploiting it?

The picture is disputed. CISA said it had not seen exploitation when it published its alert. But Amazon's threat intelligence team said it detected an attempt against one of its decoy systems on October 17, four days before the announcement, and said proof-of-concept exploits appeared within hours of the patch and were being broadly used. Cloudflare's chief technology officer, Dane Knecht, said early attacks were emerging and that the company had updated its firewall rules as a stopgap. Security firm watchTowr also reported active attempts.

Reactions

CISA urged organisations to find every system running PHP — including PHP hidden inside other software — and patch internet-facing machines first. The FBI and Britain's National Cyber Security Centre said systems that cannot be updated should be taken offline. Amazon advised companies to patch critical systems within hours and check for signs of break-ins dating back to October 17.

Why it matters

PHP powers about 75% of websites whose language can be identified, and WordPress, which runs on PHP, is used by more than 40% of all sites — from small business pages and news blogs to e-commerce stores and university portals. In Pakistan, India and across South Asia, huge numbers of business, education and government websites run on shared hosting with PHP, often on older versions. Site owners who do not patch risk having their sites defaced, their customer data stolen or their servers used to send spam and malware, which can also get sites blacklisted by search engines and ad networks.

What to do now

1. Log in to your hosting control panel and check your PHP version.
2. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or ask your host to confirm it has done so.
3. If you are on PHP 8.1 or older, move to a supported version as soon as possible.
4. Update WordPress plugins and themes after upgrading, and check that the site still works.
5. Look for unknown admin users, new files or unusual traffic since October 17.

What happens next

Linux distributions and hosting companies are rolling out patched PHP packages, and more government services are expected to come back online once updates are complete. Security agencies say further guidance will follow if CISA adds the flaws to its list of known exploited vulnerabilities.